Merge pull request #1766 from alphagov/user-orgs-and-services

User orgs and services

app/dao/users_dao.py

@@ -1,6 +1,9 @@
 from random import (SystemRandom)
 from datetime import (datetime, timedelta)
+
 from sqlalchemy import func
+from sqlalchemy.orm import joinedload
+
 from app import db
 from app.models import (User, VerifyCode)
 
@@ -113,3 +116,16 @@ def update_user_password(user, password):
     user.password_changed_at = datetime.utcnow()
     db.session.add(user)
     db.session.commit()
+
+
+def get_user_and_accounts(user_id):
+    return User.query.filter(
+        User.id == user_id
+    ).options(
+        # eagerly load the user's services and organisations, and also the service's org and vice versa
+        # (so we can see if the user knows about it)
+        joinedload('services'),
+        joinedload('organisations'),
+        joinedload('organisations.services'),
+        joinedload('services.organisation'),
+    ).one()

app/models.py

@@ -116,11 +116,11 @@ class User(db.Model):
     services = db.relationship(
         'Service',
         secondary='user_to_service',
-        backref=db.backref('user_to_service', lazy='dynamic'))
+        backref='user_to_service')
     organisations = db.relationship(
         'Organisation',
         secondary='user_to_organisation',
-        backref=db.backref('user_to_organisation', lazy='dynamic'))
+        backref='users')
 
     @property
     def password(self):
@@ -133,6 +133,38 @@ class User(db.Model):
     def check_password(self, password):
         return check_hash(password, self._password)
 
+    def get_permissions(self):
+        from app.dao.permissions_dao import permission_dao
+        retval = {}
+        for x in permission_dao.get_permissions_by_user_id(self.id):
+            service_id = str(x.service_id)
+            if service_id not in retval:
+                retval[service_id] = []
+            retval[service_id].append(x.permission)
+        return retval
+
+    def serialize(self):
+        return {
+            'id': self.id,
+            'name': self.name,
+            'email_address': self.email_address,
+            'auth_type': self.auth_type,
+            'current_session_id': self.current_session_id,
+            'failed_login_count': self.failed_login_count,
+            'logged_in_at': self.logged_in_at.strftime(DATETIME_FORMAT) if self.logged_in_at else None,
+            'mobile_number': self.mobile_number,
+            'organisations': [x.id for x in self.organisations if x.active],
+            'password_changed_at': (
+                self.password_changed_at.strftime('%Y-%m-%d %H:%M:%S.%f')
+                if self.password_changed_at
+                else None
+            ),
+            'permissions': self.get_permissions(),
+            'platform_admin': self.platform_admin,
+            'services': [x.id for x in self.services if x.active],
+            'state': self.state,
+        }
+
 
 user_to_service = db.Table(
     'user_to_service',

app/organisation/rest.py

@@ -20,7 +20,6 @@ from app.organisation.organisation_schema import (
     post_link_service_to_organisation_schema,
 )
 from app.schema_validation import validate
-from app.schemas import user_schema
 
 organisation_blueprint = Blueprint('organisation', __name__)
 register_errors(organisation_blueprint)
@@ -98,15 +97,13 @@ def get_organisation_services(organisation_id):
 @organisation_blueprint.route('/<uuid:organisation_id>/users/<uuid:user_id>', methods=['POST'])
 def add_user_to_organisation(organisation_id, user_id):
     new_org_user = dao_add_user_to_organisation(organisation_id, user_id)
-    return jsonify(data=user_schema.dump(new_org_user).data), 200
+    return jsonify(data=new_org_user.serialize())
 
 
 @organisation_blueprint.route('/<uuid:organisation_id>/users', methods=['GET'])
 def get_organisation_users(organisation_id):
     org_users = dao_get_users_for_organisation(organisation_id)
-
-    result = user_schema.dump(org_users, many=True)
-    return jsonify(data=result.data)
+    return jsonify(data=[x.serialize() for x in org_users])
 
 
 @organisation_blueprint.route('/unique', methods=["GET"])

app/schemas.py

@@ -665,19 +665,15 @@ class UnarchivedTemplateSchema(BaseSchema):
             raise ValidationError('Template has been deleted', 'template')
 
 
-user_schema = UserSchema()
-user_schema_load_json = UserSchema(load_json=True)
+# should not be used on its own for dumping - only for loading
+create_user_schema = UserSchema()
 user_update_schema_load_json = UserUpdateAttributeSchema(load_json=True, partial=True)
 user_update_password_schema_load_json = UserUpdatePasswordSchema(load_json=True, partial=True)
 service_schema = ServiceSchema()
-service_schema_load_json = ServiceSchema(load_json=True)
 detailed_service_schema = DetailedServiceSchema()
 template_schema = TemplateSchema()
-template_schema_load_json = TemplateSchema(load_json=True)
 api_key_schema = ApiKeySchema()
-api_key_schema_load_json = ApiKeySchema(load_json=True)
 job_schema = JobSchema()
-job_schema_load_json = JobSchema(load_json=True)
 sms_admin_notification_schema = SmsAdminNotificationSchema()
 sms_template_notification_schema = SmsTemplateNotificationSchema()
 job_sms_template_notification_schema = JobSmsTemplateNotificationSchema()

app/service/rest.py

@@ -82,7 +82,6 @@ from app.service.send_notification import send_one_off_notification
 from app.schemas import (
     service_schema,
     api_key_schema,
-    user_schema,
     permission_schema,
     notification_with_template_schema,
     notifications_filter_schema,
@@ -258,8 +257,7 @@ def get_api_keys(service_id, key_id=None):
 @service_blueprint.route('/<uuid:service_id>/users', methods=['GET'])
 def get_users_for_service(service_id):
     fetched = dao_fetch_service_by_id(service_id)
-    result = user_schema.dump(fetched.users, many=True)
-    return jsonify(data=result.data)
+    return jsonify(data=[x.serialize() for x in fetched.users])
 
 
 @service_blueprint.route('/<uuid:service_id>/users/<user_id>', methods=['POST'])

app/user/rest.py

@@ -19,7 +19,8 @@ from app.dao.users_dao import (
     create_secret_code,
     save_user_attribute,
     update_user_password,
-    count_user_verify_codes
+    count_user_verify_codes,
+    get_user_and_accounts
 )
 from app.dao.permissions_dao import permission_dao
 from app.dao.services_dao import dao_fetch_service_by_id
@@ -31,7 +32,7 @@ from app.notifications.process_notifications import (
 )
 from app.schemas import (
     email_data_request_schema,
-    user_schema,
+    create_user_schema,
     permission_schema,
     user_update_schema_load_json,
     user_update_password_schema_load_json
@@ -67,13 +68,14 @@ def handle_integrity_error(exc):
 
 @user_blueprint.route('', methods=['POST'])
 def create_user():
-    user_to_create, errors = user_schema.load(request.get_json())
+    user_to_create, errors = create_user_schema.load(request.get_json())
     req_json = request.get_json()
     if not req_json.get('password', None):
         errors.update({'password': ['Missing data for required field.']})
         raise InvalidRequest(errors, status_code=400)
     save_model_user(user_to_create, pwd=req_json.get('password'))
-    return jsonify(data=user_schema.dump(user_to_create).data), 201
+    result = user_to_create.serialize()
+    return jsonify(data=result), 201
 
 
 @user_blueprint.route('/<uuid:user_id>', methods=['POST'])
@@ -84,7 +86,7 @@ def update_user_attribute(user_id):
     if errors:
         raise InvalidRequest(errors, status_code=400)
     save_user_attribute(user_to_update, update_dict=update_dct)
-    return jsonify(data=user_schema.dump(user_to_update).data), 200
+    return jsonify(data=user_to_update.serialize()), 200
 
 
 @user_blueprint.route('/<uuid:user_id>/activate', methods=['POST'])
@@ -95,14 +97,14 @@ def activate_user(user_id):
 
     user.state = 'active'
     save_model_user(user)
-    return jsonify(data=user_schema.dump(user).data), 200
+    return jsonify(data=user.serialize()), 200
 
 
 @user_blueprint.route('/<uuid:user_id>/reset-failed-login-count', methods=['POST'])
 def user_reset_failed_login_count(user_id):
     user_to_update = get_user_by_id(user_id=user_id)
     reset_failed_login_count(user_to_update)
-    return jsonify(data=user_schema.dump(user_to_update).data), 200
+    return jsonify(data=user_to_update.serialize()), 200
 
 
 @user_blueprint.route('/<uuid:user_id>/verify/password', methods=['POST'])
@@ -324,8 +326,8 @@ def send_already_registered_email(user_id):
 @user_blueprint.route('', methods=['GET'])
 def get_user(user_id=None):
     users = get_user_by_id(user_id=user_id)
-    result = user_schema.dump(users, many=True) if isinstance(users, list) else user_schema.dump(users)
-    return jsonify(data=result.data)
+    result = [x.serialize() for x in users] if isinstance(users, list) else users.serialize()
+    return jsonify(data=result)
 
 
 @user_blueprint.route('/<uuid:user_id>/service/<uuid:service_id>/permission', methods=['POST'])
@@ -350,9 +352,8 @@ def get_by_email():
         error = 'Invalid request. Email query string param required'
         raise InvalidRequest(error, status_code=400)
     fetched_user = get_user_by_email(email)
-    result = user_schema.dump(fetched_user)
-
-    return jsonify(data=result.data)
+    result = fetched_user.serialize()
+    return jsonify(data=result)
 
 
 @user_blueprint.route('/reset-password', methods=['POST'])
@@ -392,7 +393,14 @@ def update_password(user_id):
     if errors:
         raise InvalidRequest(errors, status_code=400)
     update_user_password(user, pwd)
-    return jsonify(data=user_schema.dump(user).data), 200
+    return jsonify(data=user.serialize()), 200
+
+
+@user_blueprint.route('/<uuid:user_id>/organisations-and-services', methods=['GET'])
+def get_organisations_and_services_for_user(user_id):
+    user = get_user_and_accounts(user_id)
+    data = get_orgs_and_services(user)
+    return jsonify(data)
 
 
 def _create_reset_password_url(email):
@@ -420,3 +428,38 @@ def _create_2fa_url(user, secret_code, next_redir, email_auth_link_host):
     if next_redir:
         ret += '?{}'.format(urlencode({'next': next_redir}))
     return ret
+
+
+def get_orgs_and_services(user):
+    return {
+        'organisations': [
+            {
+                'name': org.name,
+                'id': org.id,
+                'services': [
+                    {
+                        'id': service.id,
+                        'name': service.name
+                    }
+                    for service in org.services
+                    if service.active and service in user.services
+                ]
+            }
+            for org in user.organisations if org.active
+        ],
+        'services_without_organisations': [
+            {
+                'id': service.id,
+                'name': service.name
+            } for service in user.services
+            if (
+                service.active and
+                # include services that either aren't in an organisation, or are in an organisation,
+                # but not one that the user can see.
+                (
+                    not service.organisation or
+                    service.organisation not in user.organisations
+                )
+            )
+        ]
+    }